Date: Thu, 20 Nov 2008 20:10:49 GMT From: Eugen Konkov <kes-kes@yandex.ru> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/129024: IPFW improvements Message-ID: <200811202010.mAKKAnxY003707@www.freebsd.org> Resent-Message-ID: <200811202020.mAKKK1tW052836@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 129024
>Category: kern
>Synopsis: IPFW improvements
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Thu Nov 20 20:20:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator: Eugen Konkov
>Release: 7.1-BETA
>Organization:
ISP Konkov
>Environment:
FreeBSD home.kes.net.ua 7.1-BETA FreeBSD 7.1-BETA #0: Sun Sep 7 13:49:18 UTC 2008 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386
>Description:
divert port
Divert packets that match this rule to the divert(4) socket bound
- to port port. The search terminates.
+ to port port. The search terminates. however,
+ on exit from the pipe and if the sysctl(8) variable
+ net.inet.ip.fw.one_pass is not set, the packet is passed again to
+ the firewall code starting from the next rule.
fwd | forward ipaddr | tablearg[,port]
Change the next-hop on matching packets to ipaddr, which can be
an IP address or a host name. The next hop can also be supplied
by the last table looked up for the packet by using the tablearg
keyword instead of an explicit address. The search terminates if
- this rule matches.
+ this rule matches. however,
+ on exit from the pipe and if the sysctl(8) variable
+ net.inet.ip.fw.one_pass is not set, the packet is passed again to
+ the firewall code starting from the next rule.
-----------------
- addr: [not] {any | me | me6 | table(number[,value]) | addr-list |
- addr-set}
+ addr: [not] {any | me | me6 | iface | table(number[,value]) | addr-list |
+ addr-set}
any matches any IP address.
- me matches any IP address configured on an interface in the system.
+ me matches any IP address configured on any interface in the system.
me6 matches any IPv6 address configured on an interface in the sys-
tem. The address list is evaluated at the time the packet is an-
alysed.
+ iface where iface is interface on system. In this case
+ addresses configures only on this interface will match
------------------
>How-To-Repeat:
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200811202010.mAKKAnxY003707>